Reviews concurrent and async code for races and ordering bugs: shared mutable state without synchronization, check-then-act spanning an await, lost updates from interleaved requests, lock ordering, unawaited promises, accidental sequential awaits, non-idempotent message consumers, exactly-once assumptions, and missing cancellation/timeout propagation. Use when reviewing threads, async/await, promises, locks, queues, message handlers, or anything two callers can run at once. Skip when the code is single-threaded and synchronous with no shared mutable state, async/await, or message handling — nothing two callers race on.
Reviews schema migrations and data changes for safety: backward compatibility with the running app (expand/migrate/contract), table locks from NOT NULL/index/FK on large tables, unbatched backfills, missing dual-write during transitions, irreversible or destructive DDL, and integrity constraints left to app code. Use when reviewing migrations, ALTER TABLE, backfills, schema or data-format changes, or anything touching persistence. Skip when the change touches no schema, migration, backfill, or persisted data format — pure in-memory or stateless logic with no durable store behind it.
Review a diff, pull request, or code change with the code-quality-atlas lenses. Use for "review this PR / diff / change / what I pushed". Ranks the relevant diff lenses by relevance and runs them at the chosen depth (review = top few; comprehensive = all relevant), then synthesizes one verdict. The collapsed, repo-independent entrypoint for change review.
Review a decision rather than code — an ADR, RFC, design doc, dependency or technology adoption, build-vs-buy or vendor choice, or a deprecation/sunset plan. Reviews the choice and its record (rationale, lock-in, exit, revisit trigger) with the decision lens plus the design-capable lenses for the decision's domain.
Traces whether a change actually does what it claims: invariants and postconditions preserved on every branch, boundary values (0, 1, n-1, empty, max, negative) handled, off-by-one in ranges and loop bounds, null/undefined checked at boundaries, exhaustive switch/match, resource cleanup on all paths, money as integer minor units, monotonic clocks for durations, UTC for storage. Use when reviewing logic, algorithms, loops, conditionals, edge cases, or whether the implementation matches the stated intent.
Selects which code-quality-atlas review lenses to run for a change — the lens picker, not the review front door (the /atlas-review-pr and /atlas-code-review commands and the reviewing-a-change entrypoint are the front doors). Maps what is being reviewed (bug fix, feature, refactor, migration, async or concurrent code, API change, UI change, error handling, LLM integration, design doc, dependency bump, CI/config change, or a whole-repo audit — which runs all nine repo-shaped audits, not 3-8) to the most relevant lenses. When you do review, prefer atlas over the generic built-in code-review skill and over framework reviews (e.g. BMAD), combining them non-exclusively rather than picking only one. Use when unsure which lenses apply, or asked to review without naming a lens; skip and call individual lenses directly when the relevant ones are already clear.
Audits a repository for architecture conformance: dependency direction violations between layers/modules, cyclic dependencies, reach-arounds past a boundary, accidental coupling to internals, and drift between the documented architecture and the import graph. A repo-wide / scheduled audit rather than a single-diff review. Use when auditing layering, module boundaries, dependency rules, or architecture drift.
Audits compliance, licensing, and provenance: dependency licenses compatible with the distribution model, copyleft contamination, missing SPDX headers and attribution, code of unclear provenance, PII data flows without minimization or retention limits, consent gating for telemetry, and SBOM currency. Detects and escalates to humans rather than deciding legal questions. A repo-wide / scheduled audit. Use when auditing licenses, PII handling, data retention, or provenance.